Skip to main content
2 of 2
added 5 characters in body
Andrey Sapegin
  • 280
  • 1
  • 3
  • 16

Stephane is right, it is quite hard to block everything possible. Rather, I would also start with security/risk analysis to identify which data/systems should be protected at which level. And then search for methods to implement desired protection level. If some protection is not possible, or is extremely complicated technically, there could be compensating controls. E.g., if blocking all "illegal" HTTP packets is not possible, than you could train staff working with high security data to avoid getting viruses through e-mail and suspicious web-pages etc.

As a technical solution to your question, it could be not only DPI, but also application firewalls, or software that offers security controls per application, for GNU/Linux it could be:

In addition, you could have a look on Data Loss Prevention systems.

Finally, in our research group we have a concept of kind of DPI filter (http://www.lock-keeper.org/), that only allows specific pre-defined types of packets to go through, while everything else is blocked. However, IMHO, this is not meant for daily Internet usage, rather this is for cases, when you need to regularly send some data to the server over Internet, but do not want to open an access to this server. In this case you could configure a firewall so, that it, for example, allows only text files of pre-defined format and size to be sent over FTP once per day within predefined time period, and blocks everything else, even if it is a valid FTP connection.

Andrey Sapegin
  • 280
  • 1
  • 3
  • 16